| CVE-2026-19982 | 7.4 | — | — | — | — | A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. | 72d ago |
| CVE-2026-19981 | 7.4 | — | — | — | — | A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, | 72d ago |
| CVE-2026-19980 | 7.4 | — | — | — | — | A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5 | 72d ago |
| CVE-2026-19963 | 7.4 | — | — | — | — | A vulnerability has been found in Edimax EW-7478APC 1.04. | 72d ago |
| CVE-2026-19962 | 7.4 | — | — | — | — | A flaw has been found in Edimax EW-7478APC 1.04. | 72d ago |
| CVE-2026-19960 | 7.4 | — | — | — | — | A security vulnerability has been detected in Edimax EW-7478APC 1.04. | 73d ago |
| CVE-2026-74356 | 7.4 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhost_get_avail_idx for a non empty | 74d ago |
| CVE-2026-73655 | 7.4 | — | — | — | — | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. | 76d ago |
| CVE-2026-70452 | 7.4 | — | — | — | — | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumven | 76d ago |
| CVE-2026-53793 | 7.4 | — | — | — | — | rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the inten | 76d ago |
| CVE-2026-49857 | 7.4 | — | — | — | — | auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. | 76d ago |
| CVE-2026-28189 | 7.4 | — | — | — | — | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions. | 76d ago |
| CVE-2026-73495 | 7.4 | — | — | — | — | blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. | 77d ago |
| CVE-2026-67579 | 7.4 | — | — | — | ash-hq / ash framework | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a | 77d ago |
| CVE-2026-11923 | 7.4 | — | — | — | ibm / security verify access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify | 77d ago |
| CVE-2026-48551 | 7.4 | — | — | — | — | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via | 77d ago |
| CVE-2026-67558 | 7.4 | — | — | — | — | The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring mat | 78d ago |
| CVE-2026-73086 | 7.4 | — | — | — | — | nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. | 78d ago |
| CVE-2026-58612 | 7.4 | — | — | — | microsoft / powershell | Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose inform | 78d ago |
| CVE-2026-22887 | 7.4 | — | — | — | intel / proset\/wireless wifi | Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may | 78d ago |
| CVE-2026-20886 | 7.4 | — | — | — | intel / proset\/wireless wifi | Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may | 78d ago |
| CVE-2026-20878 | 7.4 | — | — | — | intel / proset\/wireless wifi | Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers | 78d ago |
| CVE-2026-20795 | 7.4 | — | — | — | intel / proset\/wireless wifi | Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Dri | 78d ago |
| CVE-2026-20787 | 7.4 | — | — | — | intel / proset\/wireless wifi | Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers | 78d ago |
| CVE-2026-20745 | 7.4 | — | — | — | intel / proset\/wireless wifi | Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may | 78d ago |
| CVE-2026-20741 | 7.4 | — | — | — | intel / proset\/wireless wifi | Improper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a | 78d ago |
| CVE-2026-20739 | 7.4 | — | — | — | intel / proset\/wireless wifi | Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Driver | 78d ago |
| CVE-2026-50237 | 7.4 | — | — | — | — | A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. | 78d ago |
| CVE-2026-50236 | 7.4 | — | — | — | — | An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. | 78d ago |
| CVE-2026-15563 | 7.4 | — | — | — | — | A flaw was found in EAP's IIOP. | 78d ago |
| CVE-2026-15554 | 7.4 | — | — | — | — | the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret au | 78d ago |
| CVE-2026-72584 | 7.4 | — | — | — | — | A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote | 79d ago |
| CVE-2026-48084 | 7.4 | — | — | — | — | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. | 83d ago |
| CVE-2026-48079 | 7.4 | — | — | — | — | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. | 83d ago |
| CVE-2026-19139 | 7.4 | — | — | — | google / chrome | Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform | 83d ago |
| CVE-2026-9205 | 7.4 | — | — | — | langflow / langflow | IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function. | 84d ago |
| CVE-2026-8470 | 7.4 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Pyt | 84d ago |
| CVE-2026-70604 | 7.4 | — | — | — | — | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. | 84d ago |
| CVE-2026-16442 | 7.4 | — | — | — | redhat / build of keycloak | A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user au | 84d ago |
| CVE-2026-16443 | 7.4 | — | — | — | redhat / build of keycloak | A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core e | 84d ago |
| CVE-2026-25288 | 7.4 | — | — | — | qualcomm / orne firmware | Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. | 85d ago |
| CVE-2026-60007 | 7.4 | — | — | — | eclipse / milo | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid | 85d ago |
| CVE-2026-14838 | 7.4 | — | — | — | — | Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy | 85d ago |
| CVE-2026-66321 | 7.4 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 85d ago |
| CVE-2026-65802 | 7.4 | — | — | — | microsoft / edge chromium | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose in | 85d ago |
| CVE-2026-67598 | 7.4 | — | — | — | — | Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php th | 86d ago |
| CVE-2026-18556zero day | 7.4 | 7.9% | 3/3 | same day | n-able / n-central | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication B | 88d ago |
| CVE-2026-67316 | 7.4 | — | — | — | axios / axios | axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.proto | 88d ago |
| CVE-2026-51953 | 7.4 | — | — | — | — | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authenti | 89d ago |
| CVE-2026-18394 | 7.4 | — | — | — | — | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers | 89d ago |
| CVE-2026-8497 | 7.4 | — | — | — | devolutions / password manager | Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026. | 91d ago |
| CVE-2026-13697 | 7.4 | — | — | — | nodejs / undici | undici's cache interceptor mishandles malformed Cache-Control private directives. | 91d ago |
| CVE-2026-54660 | 7.4 | — | — | — | — | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. | 91d ago |
| CVE-2026-13690 | 7.4 | — | — | — | — | The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-facto | 91d ago |
| CVE-2026-56822 | 7.4 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 91d ago |
| CVE-2026-56821 | 7.4 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 91d ago |
| CVE-2026-15328 | 7.4 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0 | 92d ago |
| CVE-2026-14528 | 7.4 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive inform | 92d ago |
| CVE-2026-55953 | 7.4 | — | — | — | erlang / erlang\/otp | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the ser | 93d ago |
| CVE-2026-59546 | 7.4 | — | — | — | — | Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. | 93d ago |
